{"schema_version":"1.7.5","id":"SUSE-SU-2026:2831-1","published":"2026-07-09T18:55:58Z","modified":"2026-07-10T10:00:07.697788789Z","related":["CVE-2024-12224","CVE-2025-58160","CVE-2026-25727","CVE-2026-41676","CVE-2026-41677","CVE-2026-41678","CVE-2026-41681","CVE-2026-41898","CVE-2026-42327","CVE-2026-44662","CVE-2026-45784"],"upstream":["CVE-2024-12224","CVE-2025-58160","CVE-2026-25727","CVE-2026-41676","CVE-2026-41677","CVE-2026-41678","CVE-2026-41681","CVE-2026-41898","CVE-2026-42327","CVE-2026-44662","CVE-2026-45784"],"summary":"Security update for rustup","details":"This update for rustup fixes the following issues\n\nSecurity issues:\n\n- CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).\n- CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).\n- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion\n  (bsc#1257902).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n  (bsc#1270186).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-\n  openssl crate (bsc#1270619).\n- CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).\n- CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate\n  (bsc#1270795).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n  memory in rust-openssl crate (bsc#1270870).\n- CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate\n  (bsc#1270521).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate\n  (bsc#1270874).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust-\n  openssl crate (bsc#1270989).\n- rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).\n\nNon security issue:\n\n- devel:languages:rust/rustup: Missing symlink for rust-analyzer (bsc#1203257).\n\nChanges for rustup:\n\n- Completely drop openssl to prevent future security issues\n  \nUpdate to version 1.28.2~0:\n \n * Deprecate native-tls as well\n * Enable HTTP/2 support for reqwest download backend\n * Emit tracing events from log facade calls\n * download: show Debug representation for errors\n * Avoid repeated globals in tracing events\n * Log original download errors immediately\n * feat(cli/rustup-mode): add aliases to `rustup component remove`\n * Switch flate2 to use the zlib-rs backend\n * Hardlink proxies if symlinks aren't reachable\n * Add powerpc64le-unknown-linux-musl support\n * Add toolchain_name to not installed bail msg\n * Warn about using curl\n * Drop workspace indirection\n * Fold download crate back into rustup\n * download: merge integration test files\n * chore(deps): lock file maintenance\n * Test CARGO environment replacement\n * Update CARGO env var if it is a rustup proxy\n * Tweak toolchain subcommand help text\n * Move toolchain and default commands first\n * show toolchain paths in rustup show -v output\n * refactor(cli/self-update): save allocations in `Nu::rcfiles()`\n * fix(cli/self-update)!: stop appending to `env.nu` due to deprecation\n * fix(cli/self-update): consider Windows paths in Nushell suggestions\n * refactor(cli/self-update): use `path add` in `env.nu` template\n * fix(cli/self-update): use interpolated string in `env.nu` template\n * Upgrade dependencies\n * docs(user-guide/environment-variables): document `RUSTUP_VERSION`\n * feat(rustup-init/sh): allow setting `RUSTUP_VERSION` during installation\n * feat(cli/self-update): allow setting `RUSTUP_VERSION` for arbitrary\n downgrades\n * feat(test/clitools): add `Config::expect_ok_ex_env()`\n * fix(errors)!: improve error messages for `RustupError::ToolchainNotInstalled`\n * Add set auto-install disable\n * Use `cursor: pointer` for copy button on website\n * fix(dist): refine suggestions about missing targets\n * Append Windows bin directory to PATH by default\n * Remove validation for custom toolchains when reading rust-toolchain.toml\n * document RUSTUP_AUTO_INSTALL\n * Fix build script `cargo` instructions\n  \nUpdate to version 1.28.1~0:\n\n * dist(rustup-init/sh): update commit shasum\n * Update changelog for 1.28.1\n * fix!(config): re-enable implicit toolchain installation in `Cfg::local_toolchain()` with optional opt-out\n * refactor(test/clitools): extract `Config::expect_err_env()`\n * Use relative symlinks when possible\n * docs: update CHANGELOG for v1.28.1 release\n * fix!(config): re-enable active toolchain installation in `Cfg::find_active_toolchain()` with optional opt-out\n * config: make Config::find_active_toolchain() async\n * Use terse output for rustup show active-toolchain\n * Use read_timeout for reqwest instead of timeout\n * test: turn set_current_dist_date() into a Config method\n * test: privatize clitools module\n * test: remove function wrappers for cmd() and env()\n * test: privatize mock module\n * test: move create_mock_dist_server() to Scenario::write_to()\n * test: move Release into dist\n * test: turn channel builders into constructors\n * test: move mock channel builders into dist\n * test: move arch consts into top-level module\n * test: turn build_*_installer() functions into constructors\n * test: move installer builders into mock module\n * test: privatize items in clitools\n * test: keep Config impl close to type definition\n * test: privatize dist module\n * test: privatize items in test::dist\n * test: inline short module topical_doc_data\n * Remove level of nesting in test module\n * Tweak SanitizedOutput style\n * docs: update `CHANGELOG` for v1.28.0 release\n * Have mocked cargo better adhere to cargo conventions\n * Do not append `EXE_SUFFIX` in `Config::cmd`\n * Add `TryFrom<Output>` for `SanitizedOutput`\n * refactor(test): replace `(before|after)_test_async()` with `TestProcess::_telemetry_guard`\n * style(rustup-init): reorganize imports\n * refactor(log): introduce `GlobalTelemetryGuard`\n * refactor(process): rename `TestProcess::_guard` to `_tracing_guard`\n * chore(deps): update opentelemetry\n * fix(deps): update rust crate windows-registry to 0.5.0\n * refactor: improve binary suffix stripping\n * build: bump the codebase Language Edition to 2024\n * style(cli/job): fix `unsafe-op-in-unsafe-fn`\n * style(cli/log): use precise capturing when necessary\n * chore: use unsafe versions of `(add|remove)_var()`\n * style: remove redundant `ref` keywords\n * style: partially migrate away from `if-let`\n * style: format sources with the 2024 Style Edition\n * chore: fix new `clippy` warnings\n * fix(deps): update rust crate pulldown-cmark to 0.13\n * feat(rustup-init/sh): add env var to print arch detection result\n * refactor(component): reduce allocations in `ComponentPart::encode()`\n * refactor(component)!: extract `ComponentPartKind`\n * style(component): reduce right drift in `ComponentPart::decode()`\n * refactor(component)!: turn `ComponentPart`'s fields into named ones\n * fix(dist/prefix): normalize path separators in `REL_MANIFEST_DIR`\n * fix(component): normalize path separators during `ComponentPart::(en|de)code()`\n * Upgrade to rand 0.9\n * fix(ci/doc): fix typo in renovate `datasource`\n * ci(doc): make `renovatebot` bump locked `mdbook`\n * ci(doc): pin `mdbook` to `0.4.43`\n * ci(schedule): run cron tasks more times per week\n * ci(schedule): promote to use the `stable` job list\n * ci(doc): fix stable build of `user-guide`\n * ci(linux): enable the full test suite for `aarch64-unknown-linux-gnu`\n * ci(linux): use public ARM64 Linux runners\n * ci(deploy-docs): merge with `test-docs`\n * ci(deploy-docs): enable on PR without uploads\n * ci(deploy-docs): build one book per workflow step\n * ci(deploy-docs): install `mdbook` with `install-action`\n * Change installation of dependencies for Aarch64 Dockerfile\n * Run Aarch64 jobs on PRs\n * Use ARM based runners for ARM CI targets\n * style: fix `clippy` warnings\n * docs(user-guide/components): add deprecation notice for `wasm32-wasi`\n * Update Windows dependencies\n * feat(cli/rustup-mode)!: simplify error message for `rustup show active-toolchain`\n * fix(cli/rustup-mode): make `rustup show active-toolchain` exit with `1` when none is active\n * fix(cli/rustup-mode): make `rustup default` exit with `1` when there's no default\n * fix(cli/rustup-mode)!: change `rustup doc --error_codes` to `--error-codes`\n * fix(deps): update rust crate itertools to 0.14\n * fix(cli): align `rustup show`'s `--verbose` behavior with `rustup show active-toolchain`\n * feat(cli): show the toolchain path with `rustup show active-toolchain --verbose`\n * feat(test): accept more than one args in `for_host*!()`\n * fix(ci): fix installation of `cargo-all-features`\n * docs(user-guide/installation): update 'General tips'\n * move deps around\n * fix(deps): update rust crate rustls-platform-verifier to 0.5\n * fix(rustup-init/sh): don't emit 'unknown macOS major version' for macOS v11+\n * refactor(rustup-init/sh): extract `$_os_major`\n * refactor(rustup-init/sh): extract `$_os_version`\n * ci(linux): move `bindgen-cli` installation into `run.bash`\n * ci(stable): enable `loongarch64-unknown-linux-musl` builds\n * ci(linux): disable `reqwest-rustls-tls` for unsupported platforms\n * ci(linux): configure `gcc-multilib` and `libclang` for some *nix builds\n * chore(deps): bump `aws-lc-rs` and `aws-lc-sys`\n * download: clean up TLS feature guards\n * download: simplify feature guards\n * download: attach download functions to Backend type\n * download: remove intermediate reqwest-backend feature\n * Implement more complete backend selection\n * Simplify logic for download backend notification\n * docs(dev-guide/tracing): make 'Adding instrumentation' a level-2 title\n * ci(windows): don't install `awscli` via `choco`\n * test(mock/topical-doc-data): add test cases with both a flag and a topic\n * refactor(test/mock): use tuples for `topical_doc_data::TEST_CASES`\n * feat(cli/rustup-mode): allow `rustup doc` with both a flag and a topic\n * refactor(toolchain): allow passing a fragment in `Toolchain::doc_path()`\n * refactor(toolchain): allow absolute paths in `Toolchain::doc_path()`\n * refactor(toolchain): simplify `Toolchain::doc_path()`\n * refactor(cli/rustup-mode): rename `doc_url` to `doc_path`\n * refactor(cli/rustup-mode): make `DocPage::path()` return `Option<&Path>`\n * refactor(cli/rustup-mode): move `DocPage::name()` to a separate `impl` block\n * refactor(cli/topical-doc): clean up some funtions\n * refactor(cli/rustup-mode): use early return in `doc()`\n * Update semver-compatible dependencies\n * fix: make sure no overflow on small screens\n * feat: make the box white\n * feat: use the color form the rust website for tags, hr and copy button\n * Add the main element and header to setup new layout\n * chore: remove the old pitch first\n * Apply clippy suggestions\n * Append to 1.28.0 changelog\n * Bump version, commit and date in rustup-init.sh\n * Clean up trailing whitespace in rustup-init.sh\n * Add changelog for 1.28.0\n * Bump version to 1.28.0\n * chore(deps): update remove-dir-all to 1.0\n * Add aliases for remove/uninstall/unset commands\n * feat: add nushell support\n * Upgrade to opentelemetry 0.27\n * fix: add missing close body tag\n * Upgrade thiserror to 2\n * Upgrade to rustls-platform-verifier 0.4\n * fix(cli/rustup-mode): remove `.num_args()` when `.value_delimiter(',')` is present\n * refactor(cli/rustup-mode): remove deprecated `.use_value_delimiter()`\n * chore(config): migrate config .github/renovate.json\n * docs: update channel toolchain syntax\n * feat(cli/rustup-mode): support more books in `rustup doc`\n * style(cli/rustup-mode): reorder items in `docs_data![]`\n * fix: add powerpc64 and s390x to known target_arch values for tests\n * style(utils): put the `mod` declarations below the imports\n * style: regroup some imports\n * refactor(utils): hoist `utils::utils` into `utils`\n * feat(rustup-init): detect and warn about existing `settings.toml`\n * fix: fix typo in `check_existence_of_rustc_or_cargo_in_path()`\n * style: allow using `dbg!()` across `rustup::test`\n * refactor(diskio): replace `eprintln!()` with `debug!()`\n * style: enable `clippy::(dbg_macro|todo)` across the workspace\n * style: enable `clippy::print_std(err|out)` when applicable\n * style: introduce workspace-wide lint tables\n * build: use `workspace.package` properties in `Cargo.toml`\n * fix(config): improve error when overridden active custom toolchain isn't installed\n * fix(config): print special error for invalid toolchain name in override file\n * Update semver-compatible dependencies, except openssl-src\n * style(rustup-init/sh): ignore `shellcheck` SC2086 false positives\n * fix(rustup-init/sh): fix incorrect TLS warning with curl v8.10\n * tests: rust-toolchain + profile in settings\n * Remove unnecessary methods\n * replace `winreg` dependency\n * Update remove_dir_all\n * refactor(cli/common)!: deny installing a host-incompatible toolchain w/o `--force-non-host`\n * refactor(cli/common)!: take in `toolchain: String` in `warn_if_host_is_incompatible()`\n * feat(cli/rustup-mode): add `--force-non-host` to `rustup default`\n * refactor(config)!: pass the `force_non_host` flag to `Cfg::ensure_installed()`\n * refactor(cli/rustup-mode): rename `forced` to `force_non_host`\n * docs(README): Point out where to find nightly/master docs.\n * Note that selecting VS lang packs is optional\n * Make symlink_or_hardlink_file remove dest\n * Try symlinking proxies first\n * Apply clippy suggestions from 1.81\n * feat(cli/rustup-mode)!: set log level to `INFO`/`DEBUG` on `--quiet`/`--verbose` if `RUSTUP_LOG` is unset\n * refactor(cli/setup-mode): extract `update_console_logger()`\n * fix(cli/setup-mode): simplify description for `--quiet`\n * feat(cli/setup-mode)!: set log level to `DEBUG` on `--verbose` if `RUSTUP_LOG` is unset\n * refactor(common)!: remove `verbose` flag in several places\n * refactor(config): simplify `find_or_install_active_toolchain()`\n * refactor(config)!: return `LocalToolchainName` from `find_or_install_active_toolchain()`\n * refactor(config): simplify `resolve_toolchain()`\n * refactor(config): simplify `toolchain_from_partial()`\n * chore(triage): allow transferring issues to other org repos\n * Allow `rustup doc` to search for unions\n * docs(user-guide): add a link to the latest 'Previous components' section\n * test(cli_v2): introduce `update_removed_component_toolchain()`\n * feat(dist): add notes for `stable` and `beta` in `components_missing_msg()`\n * refactor(dist): inline some const strings in `components_missing_msg()`\n * refactor(dist): extract 'nightly tips' out of the match block in `components_missing_msg()`\n * fix: fix typo in several places\n * Upgrade pulldown-cmark to 0.12\n * fix(manifest): consider possible renames in `Component::try_new()`\n * ci(macos): install `awscli` from `brew`\n * refactor(config)!: make `toolchain_from_partial()` sync\n * feat(config)!: remove implicit installation from `toolchain_from_partial()`\n * refactor(config)!: make `resolve_toolchain()` sync\n * feat(config)!: remove implicit installation from `resolve_toolchain()`\n * test(cli-rustup): remove `heal_damaged_toolchain()`\n * refactor(config): extract `local_toolchain()` from `resolve_local_toolchain()`\n * refactor(config): extract `toolchain` variable from `resolve_local_toolchain()`\n * refactor(config)!: make `resolve_local_toolchain()` sync\n * feat(config)!: remove implicit installation from `resolve_local_toolchain()`\n * refactor(config)!: rename `local_toolchain()` to `resolve_local_toolchain()`\n * feat(rustup-mode): install the active toolchain by default on `rustup toolchain install`\n * fix(rustup-mode): adjust descriptions for `rustup toolchain uninstall`\n * feat(rustup-mode)!: add `ensure_active_toolchain` flag to `update()`\n * feat(config)!: add `verbose` flag to `find_or_install_active_toolchain()`\n * style(config): replace `dist::Profile` with `Profile`\n * style(config): replace `dist::TargetTriple` with `TargetTriple`\n * fix(config): call `warn_if_host_is_incompatible()` in `ensure_installed()`\n * refactor(common): use early return in `warn_if_host_is_incompatible()`\n * refactor(rustup-mode): extract `warn_if_host_is_incompatible()`\n * style(common): merge imports\n * refactor(distributable)!: avoid unnecessary clones\n * refactor(distributable)!: replace `install_if_not_installed()` with `ensure_installed()`\n * feat(config)!: add `verbose` flag to `ensure_installed()`\n * feat(config)!: return `UpdateStatus` from `ensure_installed()`\n * feat(config)!: use `Cfg::get_profile()` for unspecified profile in `ensure_installed()`\n * chore(config): add `#[tracing::instrument]` to `ensure_installed()`\n * ci(freebsd): fix build failure related to `aws-lc`\n * ci(windows): don't install OpenSSL via `choco`\n * ci(run): remove redundant `if` predicate\n * ci(run): use the detected number of test threads\n * feat(download/rustls): use `aws-lc` instead of `ring`\n * style(taplo): enable `reorder_keys` for `*dependencies` in `Cargo.toml`\n * Upgrade windows-sys to 0.59\n * fix: fix unreachable code lints on Android\n * docs(dev-guide): remove descriptions of `rustup_macros`\n * docs(dev-guide): update description of `rustup::process`\n * Remove `once_cell` dependency\n * docs(dev-guide): add guideline for atomic commits to the developer guide\n * fix: fix `clippy` lints\n * docs(user-guide): use `brew install rustup` instead of `rustup-init`\n * Bump fs_at to 0.2.1\n * chore(deps/renovate): disable `automerge`\n * Upgrade to opentelemetry 0.24\n * build(windows): don't link against `powrprof`\n * build(windows): fix typo in `build.rs`\n * fix(utils): make `ExitCode` `#[must_use]`\n * refactor(rustup-mode): introduce `ExitCode::bitand*()`\n * fix(rustup-mode): return `ExitCode(1)` when `update()` fails\n * refactor(rustup-mode)!: remove redundant `ExitCode` in `self_update()`'s callback\n * test(cli-misc): simplify `version_mentions_rustc_version_confusion()`\n * fix(rustup-mode): refine output for `rustup --version`\n * fix(rustup-mode)!: don't install toolchain on `rustup --version`\n * chore(deps/renovate): update `automerge` schedule for `lockFileMaintenance`\n * ci(check): add `taplo fmt` test for TOMLs\n * style: reformat all TOMLs with `taplo`\n * ci(gen-workflows): remove `--quiet` from `git diff`\n * refactor: use `#[cfg()]` instead of `cfg!()` when possible\n * refactor(self-update): remove outdated `do_pre_install_sanity_checks`\n * Add help message for missing toolchain\n * Rename OSProcess to OsProcess\n * Rename currentprocess to process\n * Forward to Process::var_os() directly\n * Fix home_dir() and current_dir() regression\n * feat(log): set level of `#[tracing::instrument(err)]` to `TRACE`\n * feat(log): unhide `tracing::instrument` from behind `feature = 'otel'`\n * ci(windows): increase stack size to 16MiB\n * Upload Windows artifacts into correct subdirectory\n * Fix uploading of Windows build artifacts\n * Prepare deployment on master branch\n * Grant GitHub Actions workflows access to OIDC token\n * chore(deps): update aws-actions/configure-aws-credentials action to v4\n * Authenticate CI uploads with OIDC\n * Upload release artifacts to new S3 bucket\n * chore(deps/renovate): set `prCreation` to `immediate`\n * feat(dist): refine suggestions regarding manifest checksum mismatches\n * refactor(config): extract `dist_root_server()`\n * refactor(dist): use `let-else` in `dl_v2_manifest()`\n * refactor(dist/notifications)!: inline usages of `Notification::ManifestChecksumFailedHack`\n * refactor(install): avoid extra clone in `InstallMethod::install`\n * Reorder operations in order to simplify\n * Deduplicate handling of environnment variables\n * Move if_not_empty() to calling module\n * feat(cli): warn when removing the default/active toolchain\n * feat(cli): improve warning when removing the last/host target for a toolchain\n * docs(ci): simplify the target policy in the README\n * Add loongarch64-unknown-linux-musl support\n * fix(download): fix build error with `--no-default-features --features=curl-backend`\n * feat(rustup-init): set log level to `WARN` on `-q` if `RUSTUP_LOG` is unset\n * implements quiet flag in `rustup-init.sh`\n * test(manifestation): introduce and migrate tests to `TestContext`\n * chore(manifestation): organize imports\n * add regression tests for smart guess\n * apply smart guess to `rustup update/uninstall self`\n * Disable automatic self updates in CI environments\n * feat(download/rustls): use `rustls-platform-verifier`\n * ci(windows): run `cargo all-features`\n * fix(self-update/windows): address some `unused_imports` warnings\n * fix(rustup-mode): improve `clap` error format\n * Add period in warning while checking existing rust installations\n * Move Windows-only test code into windows module\n * Asyncify CLI tests\n * Use guard type to replace with_saved_path()\n * Refactor test registry state to be more type safe\n * Inline single-use with_saved_global_state() function\n * Privatize with_saved_global_state()\n * Move change_dir() into CliTestContext\n * Move with_update_server() into CliTestContext\n * Remove Config::with_scenario()\n * Port cli_v2 to CliTestContext\n * Port cli_v1 to CliTestContext\n * Port cli_self_upd to CliTestContext\n * Port cli_rustup to CliTestContext\n * Port cli_paths to CliTestContext\n * Port cli_misc to CliTestContext\n * Port cli_inst_interactive to CliTestContext\n * Port cli_exact to CliTestContext\n * Use CliTestContext directly in self_update_setup()\n * Start CliTestContext type wrapper\n * docs(dev-guide/tracing): mention `RUSTUP_LOG` and console-based tracing\n * docs(dev-guide/linting): improve wording\n * test(dist): add simple tests for `PartialVersion`\n * chore(dist): add some doc comments\n * fix(dist): throw an error when a `PartialVersion` string doesn't start with an ASCII digit\n * ci(all-features): add `-D warnings` to `cargo check-all-features`\n * fix(currentprocess/filesource): address some `unused_imports` warnings\n * fix(currentprocess): address some `unused_imports` warnings\n * fix(regex): replace `\\d` to `[0-9]` to avoid matching non-ASCII digits\n * refactor(toolchain/names): replace `toolchain_sort` with `ToolchainName`'s `Ord` instance\n * refactor(dist)!: make `ToolchainDesc.channel` more strongly typed\n * Remove unnecessary lint suppressions\n * Use local suppression for clippy::too_many_arguments\n * Rename desc fields to toolchain\n * Remove intermediate state from error handling\n * Remove indirection in update error handling\n * Inline wrapper function\n * Reduce rightward drift\n * Propagate use of DistOptions\n * Avoid unnecessary unwrapping\n * Extract struct from InstallMethods::Dist variant\n * refactor(log): replace the `TELEMETRY_DEFAULT_TARCER` singleton with a function\n * test(clitools): revive `run_inprocess()`\n * fix(dist/arm): don't assume `armv7` if `/proc/cpuinfo` is unavailable\n * fix(dist): add fallbacks to `/proc/self/exe` in `rustup-init.sh`\n * Rename default-tls to native-tls\n * Inline small errors module\n * Inline addition/removal to programs\n * Move windows-only self_update code into windows module\n * Reorganize platform-dependent imports in self_update\n * refactor(log): replace `[Ww]arning:` log line prefix with `warn:`\n * refactor(log): rename `NotificationLevel::Debug` to `Trace` and `Verbose` to `Debug`\n * Remove unused code\n * Hoist Toolchain up into top-level toolchain module\n * Remove unused derived sorting implementations\n * Privatize internal organization of toolchain module\n * Inline argument\n * Inline trivial wrapper\n * Move toolchain resolution into Cfg method\n * Check settings version on Cfg construction\n * Move proxy toolchain resolution logic into Cfg method\n * Move rustc_version() function into Cfg\n * Expose higher-level interface in Toolchain\n * Move DistributableToolchain::installed_paths() into Cfg\n * No need to store cfg in DistributableToolchain\n * Reduce indirection in Cfg::from_partial()\n * Move Toolchain::from_partial() to Cfg\n * Take owned LocalToolchainName in Toolchain::from_local()\n * Simplify Toolchain::from_local()\n * refactor(dist): hoist `dist::dist` into `dist`\n * refactor(dist): privatize imports from `dist::dist`\n * Fix the `TODO` in `src\\toolchain\\toolchain.rs`\n * Use tracing macros directly\n * Inline single-caller maybe_trace_rustup()\n * Remove rustup test wrapper macros\n * Use tokio::main attribute\n * Attach Process-dependent utils to Process\n * Remove with_runtime()\n * fix(config): fix typo in `ActiveReason`\n * fix(log): use `RUSTUP_LOG` for internal `tracing` instead of `RUST_LOG`\n * refactor(currentprocess): make use of `Arc::default()`\n * refactor(currentprocess): rename `TestProcess.guard` to `_guard`\n * Remove currentprocess::with()\n * Privatize most TestProcess fields\n * Remove unused TestProcess::id\n * Pass Process around explicitly\n * Let argument parser handle SelfUpdateMode conversion\n * Let argument parser handle Profile conversion\n * Use simpler form for string concatenation\n * Reduce rightward drift by duplicating some Ok-wrapping\n * Rename _install_selection() to IInstallOpts::install()\n * Inline async closure\n * Move error mapping out of validation function\n * Rename do_pre_install_options_sanity_checks() to InstallOpts::validate()\n * Rename customize_install() to InstallOpts::customize()\n * Pass InstallOpts around directly\n * refactor(terminalsource): use `.eq_ignore_ascii_case()` in `ColorableTerminal::new`\n * chore(notify): sort logging macros and `NotificationLevel` on verbosity\n * chore(env): retire `RUSTUP_DEBUG` in favor of `RUST_LOG`\n * feat(log): make `console_logger()` accept `RUSTUP_TERM_COLOR` and `NO_COLOR`\n * refactor(log): reimplement `log` using `tracing`\n * refactor(test): clean up `before_test_async()`\n * chore(deps): make `tracing-subscriber` a hard requirement\n * refactor(test): setup `tracing` subscriber in `before_test_async()`\n * test(clitools): disable `run_inprocess()`\n * refactor(test): execute all `#[rustup_macros::unit_test]`s within a `tokio` context\n * refactor(log): extract `telemetry()`\n * Remove noop functions in favor of conditional compilation\n * Avoid trivial wrapper functions\n * Store process name in error variant directly\n * Inline trivial wrapper function\n * Fix misleading 'uninstalled toolchain' notification\n * refactor(ci/run): use more `target_cargo()` in `run.bash`\n * Remove trivial new() implementation\n * Use serde to encode/decode mock manifests\n * Use serde to encode/decode rustup manifests\n * Use serde to encode/decode config\n * Represent config version as an enum\n * Use serde to encode/decode manifests\n * Represent manifest version as enum\n * Use serde to encode/decode settings\n * Add tests for settings encoding\n * Derive Default for Settings\n * Represent metadata version as an enum\n * Use Default impl for Settings::profile default\n * Derive Default for Profile\n * Discard unnecessary layer of Arc\n * Externalize wrapping of DownloadTracker\n * Inline NotifyOnConsole\n * Internalize interior mutability for Notifier\n * Decouple Cfg from Notifier initialization\n * fix(dist/triple): ensure `dist::triple::known` is up to date with `platforms`\n * refactor(toolchain): reuse `dist::triple::known` in `toolchain::names`\n * refactor(dist/triple): move known triples to `dist::triple::known`\n * refactor(build): use `platforms` to verify `RUSTUP_OVERRIDE_BUILD_TRIPLE`\n * refactor(build): simplify the code obtaining the current triple\n * feat(cli): add `--quiet` to `rustup (target|component) list`\n * feat(cli): add `--quiet` to `rustup toolchain list`\n * Inline trivial single-use function utils::to_absolute()\n * Inline trivial single-use function Cfg::which_binary()\n * Inline short single-use function direct_proxy()\n * Rename new_toolchain_with_reason() to Toolchain::with_reason()\n * Move Cfg::maybe_do_cargo_fallback() to Toolchain\n * Move Cfg::create_command_for_toolchain() to Toolchain::command()\n * Extract common usage of Cfg::create_command_for_toolchain()\n * Inline trivial single-use function Cfg::create_command_for_dir()\n * Inline simple function Cfg::create_command_for_toolchain()\n * Move toolchain construction out of Cfg::create_command_for_toolchain()\n * Inline single-use function\n * Improve error message for failing .rustup creation\n * Inline trivial single-use function\n * Inline utils::current_dir()\n * Take explicit current_dir argument in to_absolute()\n * Pass current_dir down from main()\n * Update rustup.rs website to offer Rustup on Windows on Arm\n * Use Cfg::current_dir in override_remove()\n * Use Cfg::current_dir in override_add()\n * Use Cfg::current_dir in find_or_install_active_toolchain()\n * Use Cfg::current_dir for create_command_for_dir()\n * Use Cfg::current_dir for find_or_install_active_toolchain()\n * Store current_dir in Cfg for use in find_active_toolchain()\n * Enable building Rustup win-aarch64 on PR\n * Add aarch64-apple-darwin and aarch64-pc-windows-msvc to cloudfront-invalidation.txt\n * Update Other installation methods page to include aarch64-pc-windows-msvc\n * Remove unnecessary trait abstraction\n * Simplify process access to current_dir\n * Simplify process access to environment variables\n * Remove unnecessary trait bound for home::Env\n * Simplify process access to pid\n * Simplify process access to stdin\n * Simplify process access to stderr\n * Simplify process access to stdout\n * Simplify process access to argument iterator\n * fix(download): work around `hyper` hang issue by adjusting `reqwest` config\n * test(download): fix clippy warnings regarding `Mutex` in `async`\n * test(dist): add regression tests for parsing beta versions with tags\n * test(dist): introduce scenario `BetaTag` with mock test data\n * feat(dist): add support for parsing beta versions with tags in the toolchain\n * refactor(utils): move `run_future()` under `manifestation`\n * feat(config): make `create_command_for_toolchain()` async\n * refactor(config): make `update_all_channels()` async\n * refactor(self_update): make `maybe_install_rust()` async\n * refactor(config): make `ensure_installed` async\n * fix expected path-separators on windows\n * add a regression test\n * consistently add context with file path when parsing fails\n * ci(windows/gnu): install `mingw` via `bwoodsend/setup-winlibs-action`\n * ci(windows): enable CI on `x86_64-pc-windows-gnu`\n * Make manifestation test update_from_dist async\n * Make update async\n * Make default_ async\n * Make check_updates async\n * Make target_add async\n * Make target_remove async\n * Make component_add async\n * Make component_remove async\n * Make update_all_channels async\n * Make toolchain_link async\n * Make override_add async\n * Make DistributableToolchain::remove_component async\n * Make DistributableToolchain::add_component async\n * Make DistributableTool::install_if_not_installed async\n * Make DistributableToolChain::install async\n * Make toolchain.update async\n * Make update_extra async\n * Make show_dist_version async\n * Make InstallMethod::install async\n * Make InstallMethod::run async\n * Make update_from_dist async\n * Make update_from_dist_ async\n * Make try_update_from_dist_ async\n * Make update_v1 async\n * Make dist::dl_*_manifest async\n * Make common::self_update async\n * Make manifestation::update async\n * Make download retries async\n * Make DownloadCfg::download_and_check async\n * Make DownloadCfg::download_hash async\n * Make self_update::update async\n * Make check_rustup_update async\n * Make prepare_update async\n * Make get_available_rustup_version async\n * Make setup_mode::main async\n * Make self_update::install async\n * Make try_install_msvc async\n * Make download_file async\n * Make DownloadCfg::download async\n * Make download_file_with_resume async\n * Make download_file_ async\n * Make download_to_path_with_backend async\n * Make download_with_backend async\n * Make rustup_mode::main async\n * Convert run_rustup_inner to async\n * Make run_rustup async\n * Remove maybe_trace_rustup runtime setup\n * Make maybe_trace_rustup async\n * Convert main to using a tokio runtime always\n * Ring 0.17.x support Windows on ARM\n * ci(macos): use `macos-latest` instead of `macos-14`\n * fix(deps): update rust crate itertools to 0.13\n * fix(deps): update rust crate pulldown-cmark to 0.11\n * Avoid unnecessary allocations\n * Attempt to reduce duplication by adding a little abstraction\n * Move explicit_desc_or_dir_toolchain() to Toolchain::from_partial()\n * Propagate ExitStatus instead of custom ExitCode\n * Use precise internal imports\n * Use idiomatic way to proxy str data\n * Inline RustupSubcmd::dispatch()\n * refactor(filesource): replace repetitive `#[cfg()]` usages with a new `mod`\n * Fix ETA display after regression\n * Stop showing ETA after download is complete\n * refactor(cli): hoist the `handle_epipe()` call out of the `match`\n * refactor(cli): rewrite `rustup` itself with `clap-derive`\n * refactor(cli): rewrite `rustup (self|set)` with `clap-derive`\n * refactor(cli): rewrite `rustup (man|completions)` with `clap-derive`\n * refactor(cli): rewrite `rustup doc` with `clap-derive`\n * refactor(cli): rewrite `rustup (run|which|dump-testament)` with `clap-derive`\n * refactor(cli): rewrite `rustup override` with `clap-derive`\n * refactor(cli): rewrite `rustup component` with `clap-derive`\n * refactor(cli): rewrite `rustup target` with `clap-derive`\n * refactor(cli): rewrite `rustup (check|default)` with `clap-derive`\n * refactor(cli): rewrite `rustup (toolchain|update|(un)?install)` with `clap-derive`\n * refactor(cli): remove `deprecated()`\n * refactor(cli): rewrite `rustup show` with `clap_derive`\n * fix(rustup-init): fix typo in `rustup-init[.sh]` args\n * feat(download): reflect the download/TLS backends in the user agent\n * Make find_override_from_dir_walk return OverrideCfg\n * Make settings file allow multiple borrows\n * Fix doc error with `rust-toolchain.toml` custom TC\n * Make `rustup default` not error if no default\n * Update format of `toolchain list`\n * Update format of `show` and `show active-toolchain`\n * Redesign OverrideCfg to be more type-driven\n * Pull match statement out in OverrideCfg::from_file()\n * Change find_override to find_active_toolchain\n * Pull out `new_toolchain_with_reason()`\n * Pull out `ensure_installed()`\n * refactor(cli): reorder `if` statement in `cli::setup_mode::main()`\n * refactor(cli): rewrite `rustup-init` with `clap_derive`\n * Avoid code duplication for printing target/component items\n * Deduplicate code to get components from distributable\n * Merge list_{,installed_}targets\n * Merge list_{,installed_}components functions\n * fix(filesource): make some constructs only available via the `test` feature\n * fix(ci/freebsd): install ca certs to prevent `invalid peer certificate: UnknownIssuer`\n * feat(download-backend)!: make `reqwest/rustls` the new default\n * feat(download-backend)!: refine selection logic\n * Update MSVC requirements to VS 2017 to match Rust repo\n * refactor(download): use `DownloadCallBack` in `download_with_backend()`\n * ci: don't build for `i686-linux-android` due to OpenSSL v3 atomic issues\n * ci(android): update NDK version\n * fix(deps): update rust crate openssl-src to v300\n * ci(linux-gnu): install `perl-IPC-Cmd` to make OpenSSL v3 happy\n * chore(deps): update ubuntu docker tag to v24\n * docs(dev-guide): remove 'pushing to master' in the release process\n * Replace remaining winapi usage with windows-sys\n  \nUpdate to version 1.27.1~0:\n \n * chore(dist): update commit shasum in `rustup-init.sh`, take 2\n * fix(ci/linux): don't use `pip3` to install `awscli`\n * fix(ci/macos): don't use `pip3` to install `awscli`\n * chore(dist): update commit shasum in `rustup-init.sh`\n * docs: update CHANGELOG for v1.27.1\n * feat(dist): improve `changelog_helper` script\n * dist: bump `rustup` version to `1.27.1`\n * chore: fix some typos in comments\n * Remove TryFrom<PartialTargetTriple> for TargetTriple\n * Add tests for add/remove components by name with target triple\n * Replace Component::new_with_target by Component::try_new\n * refactor(self-update)!: remove confusing `get_path()` impl on Unix\n * test(self-update): ensure the resolution of #3739\n * feat(self-update): add `with_saved_reg_value()`\n * refactor(self-update): extract `(get|restore)_reg_value()`\n * refactor(self-update): extract `with_saved_global_state()`\n * refactor(self-update): use `std::io`\n * fix(self-update): replace some `#[cfg(not(unix))]` usages with `#[cfg(windows)]`\n * feat(self-update): improve error messages on Windows\n * fix(self-update): run `do_update_programs_display_version()` on `run_update()`\n * refactor(self-update): extract `get_and_parse_new_rustup_version()`\n * refactor(self-update): extract `do_update_programs_display_version()`\n * ci: don't test for FreeBSD on PRs\n * docs(user-guide): update `environment-variables`\n * refactor(self-update): eliminate needless clone\n * feat(self-update): log `RUSTUP_DIST_*` if it's set\n * feat(self-update): log `RUSTUP_UPDATE_ROOT` if it's set\n * refactor(self-update): rename `UPDATE_ROOT` to `DEFAULT_UPDATE_ROOT`\n * refactor(self-update): extract `update_root()`\n * once_cell only used with reqwest in download crate, so gate it\n * tracing unsed only from otel feature, so move it to optional\n * Add loongarch64-unknown-linux-gnu to installation docs\n * Add loongarch64-unknown-linux-gnu to cloudfront invalidations\n * Use pattern matching to make Debug impl for Cfg more robust\n * Use std IsTerminal interface\n * Rename temp::Cfg to Context\n * temp: keep definitions and impls together\n * Remove derivative dependency in favor of manual implementation\n * docs(dev-guide): move all mentions of `cargo clippy` to `linting.md`\n * docs(dev-guide): mention that we need to keep mdBook links stable\n * refactor(utils)!: rename `delete_dir_contents()` to `delete_dir_contents_following_links()`\n * fix(utils): resolve input path in `delete_dir_contents()` if it's a link\n * test(cli): ensure the resolution of #3344\n * Revert 'fix(utils): unlink input path in `delete_dir_contents()` if it's a link'\n * Revert 'refactor(utils)!: rename `delete_dir_contents()` to `delete_dir_contents_or_unlink()`'\n * Revert 'test(cli): ensure the resolution of #3344'\n * refactor(utils)!: rename `delete_dir_contents()` to `delete_dir_contents_or_unlink()`\n * fix(utils): unlink input path in `delete_dir_contents()` if it's a link\n * test(cli): ensure the resolution of #3737\n * refactor(util)!: rename `open_dir()` to `open_dir_following_links()`\n * fix(utils): don't use `O_NOFOLLOW` in `open_dir()`\n * chore: fix typo in `CHANGELOG`\n * chore(meta): update `bug_report` issue template\n * Add hr to Windows instructions\n * fix(doc): don't show the opening message when --path is used\n * chore: remove repetitive words\n * fix(deps): update rust crate opener to 0.7.0\n * fix(config): remove unnecessary debug print\n * fix(ci): fix file paths in CI-generated `*.sha256` files on *nix\n * fix(ci): correct error message after bumping reqwest\n * fix(deps): update rust crate reqwest to 0.12\n * doc(dev-guide): Fix test Lint and add explanation\n * Fix 'component add' error message\n * ci: use `stable` Rust for all clippy lints\n * style: apply clippy suggestions from Rust 1.78.0\n * fix(ci/windows): disable `cargo clippy` on `*-windows-gnu`\n * fix(shell): create parent dir before appending to rcfiles\n * fix(fish): fix definition of `Fish::update_rcs`\n * docs(dev-guide): update `release-process.md` to match the new workflow based on GitHub Merge Queue\n * ci(macos): add `MACOSX_DEPLOYMENT_TARGET` and friends\n * Replaced `.` with `source` in fish shell's `source_string`\n * Deny clippy warnings in CI\n * Rely on implicit conversion to OperationResult\n * Extract closure from match scrutinee\n * fix(cli): fix incorrect color state after `ColorableTerminal::reset`\n * docs: Add note about stability of llvm-tools.\n * Change default for RUSTUP_WINDOWS_PATH_ADD_BIN\n * ci: remove direct `renovate/*` tests\n * Fix dead_code and unused_imports warnings\n  \nUpdate to version 1.27.0~0:\n \n * docs: update `CHANGELOG` for v1.27.0\n * hack(deps): pin `openssl-sys` to 0.9.92\n * fix #3663. Feedback in terminal when opening browser for docs\n * Fix copy icon position in Safari\n * Upgrade to opentelemetry 0.22\n * fix ambiguous prompt after setting up custom installation\n * docs: rephrase and split sentence about Visual Studio license\n * Add comment on why we prefer symlinks to junctions\n * Windows: Try using symlinks if they're allowed\n * chore(ci): unify the matrix format to (mode, target)\n * ci: update runners for macOS-related workflows\n * docs: mention `apt` in installation methods\n * docs: fix missing links in `CHANGELOG.md`\n * chore(deps): update rust crate trycmd to 0.15.0\n * fix(deps): downgrade `openssl-sys` to 0.9.92\n * ci: remove the now-tier3 `mips*-unknown-linux-gnu*` targets from the build\n * Update mdbook and fix some source issues.\n * Rename `.cargo/config` to `.cargo/config.toml`\n * chore: update `CHANGELOG.md`\n * dist: bump `rustup-init.sh` version to `1.27.0`\n * dist: bump `rustup` version to `1.27.0`\n * feat: introduce `changelog_helper` script\n * Upgrade to pulldown-cmark 0.10\n * Fix some typos\n * fix(deps): update rust crate libc to 0.2.153\n * Download rust CI Docker images from a registry\n * Component is now named 'llvm-tools'\n * chore: add docstring to `is_32bit_userspace()`\n * chore: disable some unix-only helper functions on Windows\n * chore(deps): update actions/cache action to v4\n * refactor(cli): simplify case splitting on `clap::error::ErrorKind`\n * refactor(names): replace `maybe_official_toolchainame_parser` with `impl FromStr`\n * refactor: simplify `is_proxyable_tools`\n * refactor(distributable): import `ComponentStatus`\n * refactor(cli): avoid nested combinators in `has_at_most_one_target`\n * feat(cli): warn when removing the last/host target for a toolchain\n * refactor(toolchain): extract `DistributableToolchain::components()`\n * www: detect RISC-V 64 platform\n * fix(deps): update rust crate strsim to 0.11\n * chore(deps): update `renovate.json` to remove version bumps covered by lockfile maintenance PRs, take 3\n * feat(ci): configure `merge_queue` to be a PR-like event\n * feat(ci): enable the `merge_group` trigger\n * fix(ci): use `github.event_name == 'schedule'` instead of `github.event.schedule`\n * chore(deps): update `renovate.json` to remove version bumps covered by lockfile maintenance PRs, take 2\n * fix(deps): update rust crate clap to v4.4.13\n * fix(deps): update rust crate syn to v2.0.48\n * chore(deps): update rust crate opentelemetry_sdk to v0.21.2\n * fix(ci): use `github.event_name == 'push'` instead of `github.event.push`\n * feat(ci): add CI workflow generation checks\n * refactor(ci): disassemble and reorganize `ci/cirrus-templates`\n * feat(ci): add `conclusion` job\n * refactor(ci): move `freebsd-builds` to GitHub Actions\n * refactor(ci): merge all current GitHub Actions workflows into `ci.yaml`\n * chore(ci): clean up current CI files\n * chore(deps): update `renovate.json` to remove version bumps covered by lockfile maintenance PRs\n * fix(deps): update rust crate syn to v2.0.47\n * fix(deps): update rust crate proc-macro2 to v1.0.75\n * fix(deps): update rust crate clap_complete to v4.4.6\n * fix(deps): update rust crate serde to v1.0.194\n * fix(deps): update rust crate semver to v1.0.21\n * chore(deps): update rust crate thiserror to v1.0.56\n * chore(deps): update rust crate anyhow to v1.0.79\n * fix(deps): update rust crate syn to v2.0.45\n * fix(deps): update rust crate proc-macro2 to v1.0.73\n * fix(deps): update rust crate syn to v2.0.44\n * fix(deps): update rust crate quote to v1.0.34\n * fix(deps): update rust crate proc-macro2 to v1.0.72\n * chore(deps): update rust crate anyhow to v1.0.78\n * chore(deps): update rust crate thiserror to v1.0.53\n * fix(deps): update rust crate clap to v4.4.12\n * chore(deps): update rust crate tempfile to v3.9.0\n * fix(deps): update rust crate clap_complete to v4.4.5\n * chore(deps): update rust crate anyhow to v1.0.77\n * chore(deps): update rust crate thiserror to v1.0.52\n * fix(deps): update rust crate syn to v2.0.43\n * fix(deps): update rust crate openssl to v0.10.62\n * fix(deps): update rust crate proc-macro2 to v1.0.71\n * fix(deps): update rust crate syn to v2.0.42\n * chore(deps): update rust crate anyhow to v1.0.76\n * chore(deps): update rust crate hyper-util to v0.1.2\n * chore(deps): update rust crate tokio to v1.35.1\n * fix(deps): update rust crate reqwest to v0.11.23\n * chore(deps): update rust crate hyper to v1.1.0\n * docs: move 'rls' and 'rust-analysis' to separate section 'previous...' (#3591)\n * chore(deps): update actions/upload-artifact action to v4\n * Fix rustup-init failure to read ZDOTDIR from zsh when SHELL is not zsh (#3584)\n * CI: Enable rustls on loongarch64\n * CI: Revert 'Disable openssl for loongarch64-unknown-linux-gnu'\n * fix(deps): update rust crate openssl-src to v300.2.1+3.2.0\n * fix(deps): update rust crate syn to v2.0.41\n * fix(deps): update rust crate syn to v2.0.40\n * fix(deps): update rust crate libc to v0.2.151\n * chore(deps): update rust crate once_cell to v1.19.0\n * fix(deps): update rust crate clap to v4.4.11\n * fix(deps): update rust crate openssl to v0.10.61\n * Fix test permanently adding to PATH\n * chore(deps): revert `Cargo.toml` bump in #3540\n * chore(deps): revert `Cargo.toml` bump in #3532\n * chore(renovate): prevent unnecessary `Cargo.toml` bumps\n * Lock file maintenance\n * Fix panic in `component list --toolchain stable`\n * Upgrade hyper to 1.0 (#3543)\n * Clarify several docs and help messages\n * Remove rel paths from rust-toolchain.toml docs\n * CI: Disable openssl for loongarch64-unknown-linux-gnu\n * Update Rust crate url to 2.5\n * Update Rust crate winreg to 0.52\n * Update Rust crate windows-sys to 0.52.0\n * Update Rust crate termcolor to 1.4\n * Streamline dependencies in `Cargo.toml`\n * Update opentelemetry\n * [doc] windows.md: fix link\n * Inline channel pattern list\n * Remove unused import\n * Explicitly import symbols\n * Remove unused dependencies from macros crate\n * Replace usage of lazy_static with once_cell\n * Use more conventional field order in package table\n * Remove authors from Cargo manifest (per RFC 3052)\n * Use uniform dependency specification style\n * Inline `semver::Version` in `toolchain_sort`\n * Add docs specifying `toolchain_sort`'s expected behavior\n * Change key used in `toolchain_sort`\n * Inline `special_version` in `toolchain_sort`\n * Inline `toolchain_sort_key` in `toolchain_sort`\n * Replace `sort_by` with `sort_by_key` in `toolchain_sort`\n * Refine `test_toolchain_sort`\n * Suggest installing MSYS2 for `windows-gnu`\n * Fix the test toolchain_broken_symlink on Windows\n * Move `TOOLSTATE_MSG` to `dist` to serve toolchain-wide operations\n * Add test to ensure resolution of #3418\n * Add `Panics` sections to docstrings\n * Refactor `components_*_msg`\n * Delete suggestions of removing the relevant component from `component_unavailable_msg`\n * Clean up some `manifestation` logic\n * Warn when running under Rosetta emulation\n * Typo fixed in tips-and-tricks.md file\n * Adjust suggestions about sourcing `env` files\n * Restrict zsh `shwordsplit` to `downloader()`\n * Update Rust crate zstd to 0.13\n * Apply `clippy` suggestions\n * Extract `post_install_msg_unix_source_env!()`\n * Add suggestions to mention sourcing `env.fish`\n * Fix zsh word splitting for curl '--retry 3'\n * Add ksh compatibility for latest illumos and others\n * Remove redundant message if an error occurs during package extraction\n * Update Rust crate regex to 1.10.0\n * Write a custom env script for fish\n * Fix fish config dir paths\n * Update all rc fish scripts\n * Try to add support for fish shell\n * Clarify the origin of `rust-$TARGET` CI Docker images\n * Apply more `clippy` suggestions\n * Capturing IO error in download_file_with_resume (#3421)\n * Adjust instructions for manual installation (#3502)\n * Windows: Load DLLs from system32\n * When running a 32-bit rustup on an aarch64 CPU, select a 32-bit toolchain\n * Do not fallback to 'arm' in rustup-init.sh on aarch64 with 32-bit userland\n * Update Rust crate toml to 0.8\n * Mention `brew install rustup-init` in the user guide\n * Adjust section titles in the user guide\n * Update actions/checkout action to v4\n * Avoid warning for unused variant\n * fix invalid link for 1.25.2\n * 1.26.0 should not be unreleased in the changelog\n * Refactor test case `install_uninstall_affect_path`\n * Update Rust crate winreg to 0.51\n * Apply clippy suggestions from Rust 1.74 (#3497)\n * Fix rustup_only_options_stdout\n * Bring additional help section style in line with clap 4\n * Upgrade to clap 4\n * Avoid deprecated clap API\n * Isolate trycmd tests from environment\n * Update Rust crate tracing-opentelemetry to 0.21.0\n * buf writes to components\n * Update Rust crate tempfile to 3.8\n * Return the right lifetime from DistributableToolchain::install\n * Fix handling of async tests\n * Improve CI debugability\n * Refactor: Use download_cfg.notify_handler in update()\n * Authenticate when installing protoc\n * Avoid installing protoc for most CI workflows\n * Refine suggestions of sourcing `$HOME/.cargo/env`\n * Avoid `sysctl: unknown oid` stderr output and/or non-zero exit code\n * Configure automerge in Renovate\n * Fix renovate.json\n * Make `RUSTUP_TERM_COLOR`'s value case insensitive\n * Add unit tests for `RUSTUP_TERM_COLOR`\n * Support `RUSTUP_TERM_COLOR` as an override environment variable\n * macOS `uname -m` can lie due to Rosetta shenanigans\n * Migrate CONTRIBUTING.md to an mdbook\n * Build docs during CI\n * Move the user guide from doc to doc/user-guide\n * Update Rust crate tempfile to 3.7\n * Use available_parallelism replace the `num_cpus`crate\n * rustup-init.sh: Check for kernel UAPI compatibility on LoongArch\n * Enable loongarch64-linux-gnu builds on stable\n * allow `clippy::arc_with_non_send_sync`\n * Address `#[warn(clippy::useless_vec)]`\n * Address `#[warn(clippy::needless_borrow)]`\n * Address `#[warn(clippy::useless_conversion)]`\n * Address `#[warn(clippy::redundant_pattern_matching)]`\n * Address `#[warn(clippy::redundant_field_names)]`\n * Bump proc-macro2 v1.0.51 -> v1.0.63\n * Bump the openssl v0.10.52 -> v0.10.55\n * Fix typo: prerequistes -> prerequisites\n * update installation methods to use TLS v1.2\n * Disable the 'oldtime' feature of chrono\n * Update Rust crate tempfile to 3.6\n * Update Rust crate url to 2.4\n * Update Rust crate once_cell to 1.18.0\n * Make download_tracker thread safe.\n * Enable broken color in MSYS2 shells\n * Add suggest_message helper for errors\n * replace term with termcolor\n * Tweak docs\n * Improve error message for removing uninstalled target\n * Improve error message for adding unknown target\n * CI support for loongarch64-unknown-linux-gnu\n * Fix compile on rust nightly\n * Group updates to opentelemetry together\n * Improve CurrentProcess\n * Update dependencies\n * TestProcess and friends should be test only\n * Update Rust crate windows-sys to 0.48.0\n * Rework Toolchain model and drop relative file path overrides\n * Add in opentelemetry tracing as a feature\n * Remove repeated definite article\n * Make clippy happy\n * Update Rust crate toml to 0.7.3\n * Suggest right toolchain when running clippy\n * Fix small typo\n * Update Rust crate winreg to 0.50\n * Update Rust crate tempfile to 3.5\n * Compile static Mutex where possible\n * Upgrade CI image to FreeBSD 13.2\n * Update Rust crate opener to 0.6.0\n * Update Rust crate enum-map to 2.5.0\n * Bumped retry\n","affected":[{"package":{"name":"rustup","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","purl":"pkg:rpm/suse/rustup&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"ecosystem_specific":{"binaries":[{"rustup":"1.28.2~0-150400.3.13.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2831-1.json"}},{"package":{"name":"rustup","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","purl":"pkg:rpm/suse/rustup&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"ecosystem_specific":{"binaries":[{"rustup":"1.28.2~0-150400.3.13.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2831-1.json"}},{"package":{"name":"rustup","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","purl":"pkg:rpm/suse/rustup&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"ecosystem_specific":{"binaries":[{"rustup":"1.28.2~0-150400.3.13.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2831-1.json"}},{"package":{"name":"rustup","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","purl":"pkg:rpm/suse/rustup&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"ecosystem_specific":{"binaries":[{"rustup":"1.28.2~0-150400.3.13.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2831-1.json"}},{"package":{"name":"rustup","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","purl":"pkg:rpm/suse/rustup&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"ecosystem_specific":{"binaries":[{"rustup":"1.28.2~0-150400.3.13.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2831-1.json"}},{"package":{"name":"rustup","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","purl":"pkg:rpm/suse/rustup&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"ecosystem_specific":{"binaries":[{"rustup":"1.28.2~0-150400.3.13.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2831-1.json"}},{"package":{"name":"rustup","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","purl":"pkg:rpm/suse/rustup&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"ecosystem_specific":{"binaries":[{"rustup":"1.28.2~0-150400.3.13.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2831-1.json"}},{"package":{"name":"rustup","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","purl":"pkg:rpm/suse/rustup&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2~0-150400.3.13.1"}]}],"ecosystem_specific":{"binaries":[{"rustup":"1.28.2~0-150400.3.13.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2831-1.json"}}],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262831-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1203257"},{"type":"REPORT","url":"https://bugzilla.suse.com/1230032"},{"type":"REPORT","url":"https://bugzilla.suse.com/1243862"},{"type":"REPORT","url":"https://bugzilla.suse.com/1249008"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257902"},{"type":"REPORT","url":"https://bugzilla.suse.com/1270186"},{"type":"REPORT","url":"https://bugzilla.suse.com/1270521"},{"type":"REPORT","url":"https://bugzilla.suse.com/1270619"},{"type":"REPORT","url":"https://bugzilla.suse.com/1270644"},{"type":"REPORT","url":"https://bugzilla.suse.com/1270795"},{"type":"REPORT","url":"https://bugzilla.suse.com/1270870"},{"type":"REPORT","url":"https://bugzilla.suse.com/1270874"},{"type":"REPORT","url":"https://bugzilla.suse.com/1270989"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-12224"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-58160"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-25727"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-41676"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-41677"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-41678"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-41681"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-41898"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-42327"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-44662"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-45784"}]}